Overview

URL198.98.55.114/rights/login.php
IP 198.98.55.114 (United States)
ASN#53667 PONYNET
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2023-01-25 15:51:49 UTC
StatusLoading report..
IDS alerts0
Blocklist alert26
urlquery alerts
21
Malware - Botnet panel
Tags botpanel malware

Domain Summary (7)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
firefox.settings.services.mozilla.com (2) 867 2020-05-25 20:06:39 UTC 2023-01-25 04:09:39 UTC 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2023-01-25 04:09:50 UTC 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2023-01-25 04:09:41 UTC 34.117.237.239
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2023-01-25 04:10:25 UTC 35.163.1.35
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2023-01-25 04:09:34 UTC 34.120.237.76
198.98.55.114 (10) 0 2021-05-08 16:15:48 UTC 2021-10-10 09:33:38 UTC 198.98.55.114 Unknown ranking
r3.o.lencr.org (8) 344 2020-12-02 08:52:13 UTC 2023-01-25 04:09:15 UTC 23.36.76.226

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2023-01-25 2 198.98.55.114/rights/login.php Malware
2023-01-25 2 198.98.55.114/rights/bootstrap/dist/js/tether.min.js Malware
2023-01-25 2 198.98.55.114/rights/plugins/bower_components/bootstrap-extension/js/bootst (...) Malware
2023-01-25 2 198.98.55.114/rights/bootstrap/dist/js/bootstrap.min.js Malware
2023-01-25 2 198.98.55.114/rights/plugins/sweetalert/dist/sweetalert.min.js Malware
2023-01-25 2 198.98.55.114/rights/plugins/bower_components/jquery/dist/jquery.min.js Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed
2023-01-25 2 198.98.55.114 Sinkholed

ThreatFox
Scan Date Severity Indicator Comment
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla
2023-01-16 2 198.98.55.114 Agent Tesla


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 198.98.55.114
Date UQ / IDS / BL URL IP
2023-02-04 09:52:17 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-03 20:55:00 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-03 11:53:48 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-03 11:53:43 +0000 0 - 0 - 5 198.98.55.114/rights/inc/0b221f05c8d6c3.php 198.98.55.114
2023-02-02 21:22:36 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114


Last 5 reports on ASN: PONYNET
Date UQ / IDS / BL URL IP
2023-02-05 22:50:21 +0000 0 - 2 - 0 www.neuber.biz/download/FontTwister.exe 209.141.38.71
2023-02-05 21:01:02 +0000 0 - 3 - 2 209.141.37.198/AB4g5/Josho.x86 209.141.37.198
2023-02-05 20:01:53 +0000 0 - 3 - 2 205.185.121.29/596a96cc7bf9108cd896f33c44aedc (...) 205.185.121.29
2023-02-05 17:46:11 +0000 0 - 0 - 3 3l70z8dkit3itx89.digital/ 209.141.38.71
2023-02-05 16:41:35 +0000 0 - 2 - 2 209.141.37.198/AB4g5/Josho.arm 209.141.37.198


Last 5 reports on domain: 198.98.55.114
Date UQ / IDS / BL URL IP
2023-02-04 09:52:17 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-03 20:55:00 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-03 11:53:48 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-03 11:53:43 +0000 0 - 0 - 5 198.98.55.114/rights/inc/0b221f05c8d6c3.php 198.98.55.114
2023-02-02 21:22:36 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-02-04 09:52:17 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-03 20:55:00 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-03 11:53:48 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-02 21:22:36 +0000 21 - 0 - 26 198.98.55.114/rights/login.php 198.98.55.114
2023-02-02 07:25:04 +0000 21 - 0 - 26 198.98.55.114/ifex/login.php 198.98.55.114

JavaScript

Executed Scripts (5)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (29)


Request Response
                                        
                                            GET /rights/login.php HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Date: Wed, 25 Jan 2023 15:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
X-Powered-By: PHP/8.0.25
Set-Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 1886
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size:   1886
Md5:    fe63b1c5a4c1cef5831e1c53fea96819
Sha1:   85d83d158b35a42c8f02d75618d624ea9ae5e0d1
Sha256: 66570233b27c0c11c1bf1a393b51332ffc0d274fd514afbecda91dabe1750d59

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - fortinet: Malware
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EB783CFA8C8544B0574B345ABC0BF3C150979D4EFCE1A013F17B6CD48076FC63"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11572
Expires: Wed, 25 Jan 2023 19:04:30 GMT
Date: Wed, 25 Jan 2023 15:51:38 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0582B6180687DD95C7FD728F1B9DB4495B807151E309B608AD203D69708F9DA6"
Last-Modified: Tue, 24 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9135
Expires: Wed, 25 Jan 2023 18:23:53 GMT
Date: Wed, 25 Jan 2023 15:51:38 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Backoff, Content-Length, Retry-After, Content-Type, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Wed, 25 Jan 2023 15:42:49 GMT
age: 530
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    bf0c602d32b3c14606f22a86183b5e3c
Sha1:   6eabd8d83475eba731968abe1a05a8bfd272f160
Sha256: 6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "02CF421968192286BB174FF0E6C818A843C4ECA61A02CD493E6F95BB58A37015"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7122
Expires: Wed, 25 Jan 2023 17:50:21 GMT
Date: Wed, 25 Jan 2023 15:51:39 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: M2paPEFfoXkzSJs2SJsJW4neN46rZcvYHMB6Iaw8ZMRPP2eNkAvRyYFNWMWJyLue+c85gOnslmM=
x-amz-request-id: V93NY7PSDGXGQXJQ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Wed, 25 Jan 2023 15:19:43 GMT
age: 1916
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    7b922915ebf1fa3639b333f994c74f24
Sha1:   144a3f80b98fd0652d4614f24cf6cbbee40f8938
Sha256: adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Wed, 25 Jan 2023 15:51:39 GMT
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /rights/plugins/sweetalert/dist/sweetalert.css HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Wed, 25 Jan 2023 15:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Wed, 14 Dec 2016 22:39:02 GMT
ETag: "59ad-543a600e20d80"
Accept-Ranges: bytes
Content-Length: 22957
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text
Size:   22957
Md5:    d8cc26070373f41241f37ce5a9c9d885
Sha1:   3ecb6f91187c0153724c950efcea0b0d944fd5aa
Sha256: 460df149ba9d2eb000637d9bfb2df51c5080a19e9071ff4ed5a4b7e21a0bd2f1

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET /rights/bootstrap/dist/js/tether.min.js HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Wed, 25 Jan 2023 15:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Tue, 15 Nov 2016 15:37:46 GMT
ETag: "6144-54158bceb0680"
Accept-Ranges: bytes
Content-Length: 24900
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (24900), with no line terminators
Size:   24900
Md5:    99d5eb445062f5f3b82d29aa2680e4a2
Sha1:   5c2a19c60f8ab7306c43bd68feebb3c9d3282c3c
Sha256: ff9a470d98767efd5e6489b27e24e1b41e408382ea0e3ca2b6d4fb7cb8dd4fff

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - fortinet: Malware
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET /rights/bootstrap/dist/css/bootstrap.min.css HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Wed, 25 Jan 2023 15:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Fri, 06 Jan 2017 11:12:50 GMT
ETag: "24dd4-5456b1930d080"
Accept-Ranges: bytes
Content-Length: 150996
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (65317)
Size:   150996
Md5:    7e923ad223e9f33e54d22e50cf2bcce5
Sha1:   8b7cb193d70bb476db06651c878dfcd1a7e1c0ee
Sha256: aebf611c1438dc7ec748e9a6364c734066b34bf2a1c7e2fc6511ed784635b50e

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET /rights/plugins/bower_components/bootstrap-extension/js/bootstrap-extension.min.js HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Wed, 25 Jan 2023 15:51:38 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Mon, 13 Mar 2017 08:12:32 GMT
ETag: "68a7-54a9845e9fc00"
Accept-Ranges: bytes
Content-Length: 26791
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (26402)
Size:   26791
Md5:    0c241eb74c0986ffefa56dc8308dd0ee
Sha1:   26b62a6286256442b6be8ce4b51dd3a34ac6588d
Sha256: bb5e2d3039b4fddffc1e711897eaffc7ddcf7256fea855989d37c4b1aa8bed8d

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - fortinet: Malware
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET /rights/bootstrap/dist/js/bootstrap.min.js HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Wed, 25 Jan 2023 15:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Fri, 06 Jan 2017 11:12:54 GMT
ETag: "b63d-5456b196dd980"
Accept-Ranges: bytes
Content-Length: 46653
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (32075)
Size:   46653
Md5:    0827a0bdcd9a917990eee461a77dd33e
Sha1:   6107d146e54a67c9998230abf839301575d05702
Sha256: fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - fortinet: Malware
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET /rights/plugins/sweetalert/dist/sweetalert.min.js HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Wed, 25 Jan 2023 15:51:38 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Wed, 14 Dec 2016 22:39:02 GMT
ETag: "4262-543a600e20d80"
Accept-Ranges: bytes
Content-Length: 16994
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (16994), with no line terminators
Size:   16994
Md5:    2f9966a615f3f46d846807adbe42644f
Sha1:   441544c084828da55ca0bafdc4c3df7dc7020820
Sha256: be4d1215ef6f2b2915b7f65cd28b9a9f7dcef17e1f0d883edd19400ca0ea795c

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - fortinet: Malware
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET /rights/plugins/bower_components/bootstrap-extension/css/bootstrap-extension.css HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Date: Wed, 25 Jan 2023 15:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Thu, 13 Apr 2017 15:47:32 GMT
ETag: "1302f-54d0e3e403705"
Accept-Ranges: bytes
Content-Length: 77871
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (65511)
Size:   77871
Md5:    83f991966f4fe9b5e26dcb79c267a630
Sha1:   9810c2f654b171419de327c8048a7141b663a783
Sha256: 0ca13f118a0ac8dc77f0894b67dffe9861d52218cbbbaa2150ccf113665c6bfc

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET /rights/plugins/bower_components/jquery/dist/jquery.min.js HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Wed, 25 Jan 2023 15:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Sun, 09 Apr 2017 12:51:03 GMT
ETag: "1498c-54cbb4faede9b"
Accept-Ranges: bytes
Content-Length: 84364
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (32025)
Size:   84364
Md5:    512d9517dac8bd35b30856de88170212
Sha1:   fcb6d93a78864e9068c597ac843b0c4724248337
Sha256: 70ea5c0fd61a431fef3e564d404e868b8017cdf8525f37ef2e1a64299246003b

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - fortinet: Malware
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Last-Modified, ETag, Expires, Backoff, Content-Length, Cache-Control, Alert, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Wed, 25 Jan 2023 15:41:40 GMT
age: 599
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "18E19EA4C9C262CB9A94F89172EEF2604222E779346589D470BF2E95EA295563"
Last-Modified: Tue, 24 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10987
Expires: Wed, 25 Jan 2023 18:54:46 GMT
Date: Wed, 25 Jan 2023 15:51:39 GMT
Connection: keep-alive

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: 198.98.55.114
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://198.98.55.114/rights/login.php
Cookie: PHPSESSID=4im02d8vvpc88h5kfoe7eu191g

search
                                         198.98.55.114
HTTP/1.1 200 OK
Content-Type: image/x-icon
                                        
Date: Wed, 25 Jan 2023 15:51:38 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Thu, 16 Jul 2015 15:32:32 GMT
ETag: "78ae-51affc7a4c400"
Accept-Ranges: bytes
Content-Length: 30894
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive


--- Additional Info ---
Magic:  MS Windows icon resource - 3 icons, 64x64, 32 bits/pixel, 48x48, 32 bits/pixel\012- data
Size:   30894
Md5:    6eb4a43cb64c97f76562af703893c8fd
Sha1:   c50c4273b9d2433c6069454f971ed6653e07c126
Sha256: 1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9

Alerts:
  urlquery:
    - Malware - Botnet panel
    - Malware - Botnet panel
  Blocklists:
    - threatfox: Agent Tesla
    - quad9: Sinkholed
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: +kJ6qavAk4nFQ4XT5IwunA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         35.163.1.35
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: EIKgpZQEkorVjKJERKByXT7KU9k=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C41996D83D942CA58A13E2D1ADFD171CF26A84BC9B7FDBD1CA941EB0269B5404"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2985
Expires: Wed, 25 Jan 2023 16:41:26 GMT
Date: Wed, 25 Jan 2023 15:51:41 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C41996D83D942CA58A13E2D1ADFD171CF26A84BC9B7FDBD1CA941EB0269B5404"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2985
Expires: Wed, 25 Jan 2023 16:41:26 GMT
Date: Wed, 25 Jan 2023 15:51:41 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C41996D83D942CA58A13E2D1ADFD171CF26A84BC9B7FDBD1CA941EB0269B5404"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2985
Expires: Wed, 25 Jan 2023 16:41:26 GMT
Date: Wed, 25 Jan 2023 15:51:41 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "C41996D83D942CA58A13E2D1ADFD171CF26A84BC9B7FDBD1CA941EB0269B5404"
Last-Modified: Wed, 25 Jan 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2985
Expires: Wed, 25 Jan 2023 16:41:26 GMT
Date: Wed, 25 Jan 2023 15:51:41 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F09ccbe5e-77b1-4d6d-98f5-a477f3861d8c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 12758
x-amzn-requestid: c3540562-8c62-4957-9528-7ae952daebaa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e9gf1E87oAMFpsQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c87acb-49fd3f78275937e24d23fca3;Sampled=0
x-amzn-remapped-date: Wed, 18 Jan 2023 23:03:39 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: c5YOTqrEv9RLv_lKsrC377yost8auxYRPLubBFGjIWtnbueiGMJYGw==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 324a68a6c25ee50d774953f3e15a611c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 05:14:35 GMT
age: 38226
etag: "0f5d2a6d846f4f8f85dd7e8089e643cacc57d8a9"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   12758
Md5:    7458f7a9b2070055df6f1d496794e43e
Sha1:   0f5d2a6d846f4f8f85dd7e8089e643cacc57d8a9
Sha256: 373097662c419eef9f4a19ce9f3bcead70f6eafbf0acf44806685eece43ce251
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F67efee66-d227-4c28-89a3-8fd7f382049b.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8308
x-amzn-requestid: 1988d3b3-5e1a-41fd-83f5-092eddb9185f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fNys5GDKoAMFdbA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cefe52-2349fde60b7db8a34c996717;Sampled=0
x-amzn-remapped-date: Mon, 23 Jan 2023 21:38:26 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 5_1j_Z6HZ3DSGFPAACJduM5D9eAqMQT42GgI61x8dHAmPQtUexpEYQ==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 21:59:15 GMT
age: 64346
etag: "42d5b4b4a091778d98c351f0002d8656449d0243"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8308
Md5:    91b2e12a39dc4f63b9d52e8800cce1f2
Sha1:   42d5b4b4a091778d98c351f0002d8656449d0243
Sha256: d4dbc79e3383e83f861ccf8cde3e78ba427a66cd3fa99c17e23ec935867de4ad
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F46e473b9-0adb-4371-8146-b148ce85cdec.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8252
x-amzn-requestid: a5a39d22-de0e-4b2e-b3e2-aad1d0090881
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fEqtiHo7oAMFdCQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cb57f0-0cd78ff23e91baf668276053;Sampled=0
x-amzn-remapped-date: Sat, 21 Jan 2023 03:11:44 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: s8JWGyQ0pTWcaGk0n2PQOpAhjKLuNlbI4wCZAidzoBR5RQreO2rh9g==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 d8792dbd3191bbe722eba5b536b979c8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 05:15:35 GMT
age: 38166
etag: "c9b86b2b27063e0a58b0f237d451f9cf05b2122d"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8252
Md5:    d10114508bd40d76f497fc5b9c064350
Sha1:   c9b86b2b27063e0a58b0f237d451f9cf05b2122d
Sha256: a156bd21bee2fca1d82940fb172a695044321ed432786ae100a7baf3b5e12b3f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9192d2a7-4090-4a55-b72e-388ceb1f506d.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10921
x-amzn-requestid: 7b8849e6-b52d-4165-b456-b200ddbb993b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fEqtkGThIAMFb7g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cb57f0-1ed4803112d97956419b299e;Sampled=0
x-amzn-remapped-date: Sat, 21 Jan 2023 03:11:44 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: FUbNMfYy8ci6d78p6LCu0Gxs3jw824ZzVp6drAbl8HCDBpghlZFP7g==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 82ea95080f526df99896343fb7269b06.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 07:57:09 GMT
age: 28472
etag: "b199a381ccac4628f2bfa626b44c71954713ca98"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10921
Md5:    1d76c1b1126a3e1b51dcca652cb6727b
Sha1:   b199a381ccac4628f2bfa626b44c71954713ca98
Sha256: 3a34f2b7f79cb925c73d2c17197418004e4acf63a6eb69e471320069978f8282
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33050e82-3c0a-40d6-a722-e4ff96872edc.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6026
x-amzn-requestid: 4b05d7f7-783f-4a79-9eed-bbbeb53bc677
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fRQ-QHmZIAMF6gw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d061f4-721f473c5c8dadd163ca7689;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 22:55:48 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: -GQ5kEZvbltzLlBeml1PxYH3ufTrSMApVjDyR_NkR-6-vXfuJHOb0g==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Tue, 24 Jan 2023 23:09:45 GMT
age: 60116
etag: "7596b783e0da5fba63c49374933eccffc223d729"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6026
Md5:    bb6c1403a1d3c878c08ccaf17f8b3d0a
Sha1:   7596b783e0da5fba63c49374933eccffc223d729
Sha256: 1524dbef51237950d4a14a0e2e053fad933dd92ee0831e2de5c45513122f1d58
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3f7aba17-803f-412c-8ef7-0959b52f87cc.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9650
x-amzn-requestid: 3b968ee5-c941-4305-9f06-01e646deef15
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fH88wEUmoAMFerw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cca851-061f65177f36420a4685f372;Sampled=0
x-amzn-remapped-date: Sun, 22 Jan 2023 03:06:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: xfiiS5M5j8iYKMyopaVqwYV6KKB1VIWT_yQbEKZ9G1wuq2QUEyDBpA==
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 25 Jan 2023 03:10:29 GMT
age: 45672
etag: "958b50e9e7e5e02882d55612a5d6d2402e225390"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9650
Md5:    13891ffe8a0cc240be63b7945e4b7688
Sha1:   958b50e9e7e5e02882d55612a5d6d2402e225390
Sha256: 1570d69731ba13051454a048ac85bde7c1de8e39dea0fd78e7e5c3f2be122cb6